How to Audit and Clean Up Orphaned Endpoints Across Multiple Tenants or Clients Orphaned endpoints can quietly weaken your security posture and inflate licensing costs. For MSPs, regular endpoint audits are critical to maintaining visibility and accuracy across tenants. Before we begin, be sure to subscribe to NinjaOne’s IT video hub for more tech content like this. Step 1: Defining Orphaned Endpoints First, let’s define what orphaned endpoints are. An orphaned endpoint is a device that still exists in your RMM or PSA tools but is no longer actively managed. Common indicators include devices that haven’t checked in for over 30 days, show no recent user logins, have missing agents, or appear as duplicates after reimaging. To conduct an effective endpoint audit, it’s essential to establish clear criteria for identifying orphaned endpoints. By doing so, you can prevent false positives during audits. One way to simplify the identification and tracking of orphaned endpoints is to tag them based on the last check-in date, user activity, AV status, and hostname validation. Step 2: Auditing Endpoints In this section, we’ll discuss the different ways you can use to conduct an endpoint audit. You can use PowerShell to quickly determine a device’s last boot time, recent user logons, and system uptime. To do so, open PowerShell and run the appropriate script. Once you have the data you want, you can cross-reference these results with your RMM or domain activity logs to confirm inactivity. You can manually validate potential unmanaged systems before clean-up using Command Prompt. Simply open an elevated Command Prompt and run the appropriate commands. You can use the table onscreen as a reference. Missing agents combined with extended inactivity often indicate an orphaned or unmanaged endpoint. To avoid any issues, validate these endpoints before removal. Alternatively, you can use the registry, Group Policy, Scheduled Tasks, or your existing management platforms to audit endpoints. You can read more about each method in our official blog post. Step 3: Cleaning Up and Decommissioning Endpoints Presenter: Once an endpoint is confirmed as orphaned, follow a consistent cleanup process. Generally, this involves: Uninstalling RMM, AV, and backup agents Archiving relevant logs and registry data Removing the device from AD, RMM, and PSA systems Tagging it as “Decommissioned” Documenting this process ensures consistency across tenants. For more information, check out our official blog post on How to Audit and Clean Up Orphaned Endpoints Across Multiple Tenants or Clients linked in the description below.